During performance and scalability reviews of sites, we regularly find ourselves submitting patches to contrib modules and core to resolve performance issues.
Most large Drupal installations we work with use a variation of this workflow to track patches:
- Upload the patch to an issue on Drupal.org if it's not already there
- Add the patch to a /patches folder in revision control
- Document what the patch does, the Drupal.org nid, and a reference to the ticket in the client's issue tracker in /patches/README.txt
- Apply the patch to the code base